BlackWallet Hack

REPORTED LOSS $400K
Low Access Control

What happened

A DNS hijack has led to hackers withdrawing $400,000 worth of Stellar Lumen (XLM) coins from wallets hosted by Blackwallet.co without users’ permission.

As multiple sources reported, attackers took control of BlackWallet’s hosting server, changing settings to allow code to run which automatically sent customer balances over 20XLM to an address under the hackers’ control.

The hacker's wallet:

https://stellarchain.io/address/GBH4TZYZ4IRCPO44CBOLFUHULU2WGALXTAVESQA6432MBJMABBB4GIYI

Case & protocol details

Classification CeFi
Protocol Type Exploit/Access control
Official Website blackwallet.co/

Evidence & learning

Attack pattern

Compare incidents →
Access Control Attacks

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

AFX $24.1M
B² Network $3.8M
Third-party SquidRouterModule $3.2M
StablR $12.8M

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes